<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('create.content'); $rowId = (int)($_POST['row_id'] ?? 0); $blockType = trim($_POST['block_type'] ?? 'context'); $configJson = trim($_POST['config_json'] ?? '{}'); if (!$rowId) { exit(json_encode(['success' => false, 'error' => 'row_id required'])); } $validTypes = ['context','sale','countdown','raffle','referral','testimonial','stats','gallery','text','image','banner','video','html']; if (!in_array($blockType, $validTypes, true)) { $blockType = 'context'; } $row = Database::fetchOne("SELECT id FROM storefront_rows WHERE id = :id", [':id' => $rowId]); if (!$row) { exit(json_encode(['success' => false, 'error' => 'Row not found'])); } $encConfig = Encryption::encrypt($configJson, 'product'); $next = Database::fetchOne("SELECT COALESCE(MAX(item_order),0)+1 as n FROM order_items WHERE row_id = :r", [':r' => $rowId]); $nextOrder = (int)($next['n'] ?? 1); $newId = Database::insert( "INSERT INTO order_items (row_id, item_type, slot_width, item_order, block_type, block_config_enc)      VALUES (:r, 'block', 1, :o, :bt, :cfg)", [':r' => $rowId, ':o' => $nextOrder, ':bt' => $blockType, ':cfg' => $encConfig] ); exit(json_encode([ 'success' => true, 'item' => [ 'id' => $newId, 'item_type' => 'block', 'slot_width' => 1, 'block_type' => $blockType, 'block_config_enc' => $configJson ] ])); 